Reject archived parent targets in Board JSON hierarchy imports

[Chris0Jeky]

Follow-up from PR #2965 review comment 3984069198 at 5ba1892.

Source-confirmed MEDIUM contract gap: hand-crafted version-3 Board JSON can name an archived card as another card's parent. Import calls SetParent before Archive, and full graph validation checks existence, scope, cycles and depth but not parent archive state. Normal create/update/proposal lanes reject archived parents; ordinary archive detaches all direct children, so a clean ordinary export cannot produce this graph.

Import creates a fresh board and fresh card IDs. This does not overwrite existing data or bypass board authority. No separate runtime probe is claimed for this finding.

Residual acceptance: reject archived parent targets atomically before import commit, while preserving valid archived children whose parent remains active. Prove both cases, old plain/v2 compatibility, and no partial board creation. Do not change restore behavior or historical account export.

Keep Pending. No implementation claim; the current hard-work programme is finishing hierarchy and then assignment.

[Chris0Jeky]

[Claude lane claim v2]

• Lane: alpha-product-trust
• Base SHA: 48865cd90da95b81ab0f60764dfa126bf284be92 (origin/main at claim time)
• Worktree / branch: isolated worktree, branch issue-2966/reject-archived-import-parents
• Owned paths (exclusive for this slice):
  • backend/tests/Taskdeck.Application.Tests/Services/BoardJsonExportImportRoundTripTests.cs
  • backend/tests/Taskdeck.Api.Tests/CardHierarchyContractTests.cs
• Shared-path leases (short, additive only):
  • backend/src/Taskdeck.Application/Services/BoardJsonExportImportService.cs — a single inserted validation block inside ImportBoardAsync, placed in the existing pre-creation validation pass (immediately after the cardIds source-ID loop, before new Board(...)). No existing line is rewritten, so the overlap with PR Add multiple card assignments and explicit import mapping #2977 (card assignments, same file) stays a trivial merge. I deliberately avoided ExportImportServiceTests.cs, which Add multiple card assignments and explicit import mapping #2977 also edits.
• Not touched: account/GDPR export and database restore paths, CardHierarchy domain validator, CardService/proposal lanes, frontend, docs governance scripts.
• Parallel-safe work: anything outside BoardJsonExportImportService.ImportBoardAsync's validation preamble and the two test files above. PR Add multiple card assignments and explicit import mapping #2977 can keep editing the card-creation loop and export side of the same service file.
• Approach: reject a version-3 payload whose card names an archived card as its parent, before any board/column/card is constructed, with the same ValidationError shape (HTTP 400) the import already uses for missing-parent/cycle/depth failures and the same wording as the create/update/proposal lanes (ValidateActiveParent: "Restore the parent card before assigning it."). Valid archived children under an active parent keep importing; plain/v2 payloads are unaffected.
• Status: claimed, implementation starting.

[Chris0Jeky]

[Claude lane release v2]

• Lane: alpha-product-trust
• PR: Reject archived parent targets in Board JSON hierarchy imports #2994 (READY, not draft) — Closes #2966 confirmed via closingIssuesReferences
• Branch / exact head: issue-2966/reject-archived-import-parents @ 72ca9200ba105dc83672a9c9423c77e8838397b2
• Base at branch point: 48865cd90da95b81ab0f60764dfa126bf284be92
• Result: implemented and verified; not merged (merge disposition belongs to the review gate).

Released paths — no further edits from this lane:

• backend/src/Taskdeck.Application/Services/BoardJsonExportImportService.cs (lease closed; one inserted block in ImportBoardAsync, no existing line rewritten, so the overlap with PR Add multiple card assignments and explicit import mapping #2977 stays a trivial merge)
• backend/tests/Taskdeck.Application.Tests/Services/BoardJsonExportImportRoundTripTests.cs
• backend/tests/Taskdeck.Api.Tests/CardHierarchyContractTests.cs
• docs/product/CARD_HIERARCHY.md (one sentence in the existing Board JSON import paragraph)

docs/STATUS.md deliberately untouched — no current hierarchy block to append to, and PR #2947 owns STATUS reconciliation.

Verification at that head: dotnet test backend/Taskdeck.sln -c Release -m:1 green, exit 0 — 9423 passed, 34 skipped, 0 failed (Domain 1674, Application 4328, Api 3143/+4 skipped, Cli 243, Architecture 28/+1, Integration 7/+29). node scripts/check-docs-governance.mjs and node scripts/check-doc-links.mjs both passed. Both rejection tests were confirmed red with the source change reverted and green with it restored.

Worktree reported to the coordinator as ready for removal.